rustore-apk-mcp: verified RuStore APKs for an agent
rustore-apk-mcp
The agent names a package and gets an APK from RuStore on disk with signature verification, no browser, account or API key
- 0 ★ on the repository
- Last commit
Extended access
Why this level
- The server reaches the network and writes downloaded files to disk in the downloads folder
- The APK passes signature verification, but no malware analysis is done
Install
- Works in
- Services
Manual install
claude mcp add rustore-apk --env APK_MCP_DOWNLOAD_DIR="$PWD/downloads/mcp" -- "$PWD/.venv/bin/rustore-apk-mcp"Clone the repository and run `uv sync --locked` first; set the call timeout to at least 600 seconds.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The server reaches the network and writes downloaded files to disk in the downloads folder
- The APK passes signature verification, but no malware analysis is done
This is third-party code. Review the repository files before installing.
What it does
The MCP server downloads the latest version of a free app from RuStore by package name. The `get_apk_info` tool returns the name, version, minimum Android SDK, price, certificate and store URL, while `download_apk` fetches the file and verifies it before saving. Only the RuStore API and CDN are used, the `static.rustore.ru` host is pinned and redirects are not followed. Verification runs as a chain: declared size, ZIP integrity, package name and version code from `AndroidManifest.xml` through `aapt`, the signature through `apksigner`, then a check of the certificate against the SHA-256 fingerprint RuStore reports. A file that fails a step never reaches the downloads folder. The server installs and runs nothing.
Who it is for. Android app analysts and QA engineers whose agent needs a genuine APK from the Russian store for review, version comparison or tests.
Good fit when
- An agent must analyze the APK of a Russian app and there is no time to fetch the file from the store
- Before a test you must confirm the file is signed by the publisher RuStore lists
- You need the version and minimum SDK without downloading
- Codex or Claude Code scripts take fresh builds from a list of packages
Not a fit when
- You need paid apps or split builds: the server takes only free standalone APKs
- You need version history: only the latest is available
- You need malware analysis: the signature confirms the publisher, not the safety of the file
Example request
Download the APK for ru.foodfox.client from RuStore and tell me where the file is and which version it holdsMCP
- Transport
- stdio
- Authentication
- not required
Environment variables
APK_MCP_DOWNLOAD_DIR- Downloads folder, `~/Downloads/rustore-apks` by default
APK_MCP_AAPT- Path to `aapt`, auto-discovered by default
APK_MCP_APKSIGNER- Path to `apksigner`, auto-discovered by default
Limitations
Python 3.11 or newer, uv, Java and Android SDK Build Tools with `aapt` and `apksigner` are required. Only the latest version of a free app as one APK is available; the download profile is fixed: Android SDK 36, `arm64-v8a`, 480 dpi. The RuStore consumer API is not a stable contract and may change without warning. A 403 or 429 reply stops the call with no retries. Ceilings: five minutes for the download and 4 GiB after unpacking during verification. For Codex the call timeout is raised to 600 seconds.
How to disable. Run `claude mcp remove rustore-apk` or remove the `rustore-apk` block from the client configuration; downloaded files sit in the `APK_MCP_DOWNLOAD_DIR` folder.
FAQ
Is a RuStore account or key needed?
No: the server works without an account, an API key or a browser, using only the open store API and CDN.
What is checked on the downloaded file?
Size, ZIP integrity, package and version from the manifest, the signature through `apksigner` and the certificate matching the fingerprint RuStore reports.
How do I add the server to Codex?
Run `codex mcp add rustore-apk --env APK_MCP_DOWNLOAD_DIR="$PWD/downloads/mcp" -- "$PWD/.venv/bin/rustore-apk-mcp"` and raise `tool_timeout_sec` to 600 in the configuration.
Which apps can be downloaded?
Free ones, the latest version and as a single APK; the server rejects a paid app at once, as it does split builds.
What must be installed besides Python?
uv, Java and Android SDK Build Tools with `aapt` and `apksigner`. Paths are found automatically or set through `APK_MCP_AAPT` and `APK_MCP_APKSIGNER`.
Discussion
No questions or reviews yet.
Related
All RuStore tools34 RuStore Console tools: APK and AAB uploads, moderation, reviews, payments and subscriptions from an agent chat
A plugin, a skill and a standalone MCP server with 22 RuStore tools: draft, AAB upload, moderation and publishing
RuStore ASO
RuStore ASO Skill
An app store optimization skill for RuStore: metadata, search tags, categories, ranking factors and listing conversion
App Store Connect MCP
appstoreconnect-mcp
An MCP server for App Store Connect: subscription prices by country, offers, review submission and sales reports straight from an agent chat
Google Play Developer MCP
google-play-developer-mcp
An MCP server for Google Play Console: releases and tracks, staged rollouts, store listings, reviews and subscriptions from an agent chat
MCP server for Android through ADB and scrcpy: an agent sees the screen, taps, types text and launches apps.
README in short
The README compares the server with ordinary APK mirrors, gives a quick install for Codex CLI and Claude Code, describes two tools and six verification steps. It includes an honest list of limits and a table of variables, and the Russian version lives in `README.ru.md`.